{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "item": { "id": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "slug": "apply-wazuh-index-policies-to-existing-and-future-indices-deliberately", "url": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately.md", "json": "https://update.dsesecurity.com/api/v1/posts/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/" }, "title": "Apply Wazuh index policies to existing and future indices deliberately", "summary": "Review Wazuh ISM assignment to future index patterns separately from explicit attachment to existing indices. Approve the intended deletion population and age condition before enabling automation.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-30T06:47:14+00:00", "modified_at": "2026-10-30T06:47:28+00:00", "reviewed_on": "2026-10-30", "reading_minutes": 3, "word_count": 516, "potentially_affected": "Wazuh indexer deployments using the documented Index State Management retention procedure.", "dse_recommendation": "DSE recommends reviewing existing-index attachment and future-index template coverage as separate acceptance lists before enabling deletion.", "primary_source": { "name": "Wazuh — Index lifecycle management", "url": "https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/index-lifecycle-management.html", "published_on": null, "authority": "documentation.wazuh.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Define the indices covered by a retention policy before enabling its deletion action. Keep automatic assignment to future indices separate from applying the policy to the existing population.

\n

Source fact: documented behavior

\n

The Index lifecycle management guide uses ISM policies to trigger index operations from conditions such as age, size and document count.

\n

The retention procedure uses an ISM template and index pattern for automatic policy assignment to future alert indices.

\n

It separately directs an operator to select existing indices and apply the policy to them, while the deletion example transitions on minimum index age.

\n

What the source does not establish

\n

This article plans policy assignment and an index-age deletion condition. It does not set a legal retention period, equate index age with every contained document’s age or approve deletion of any index merely because its name matches an example.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends reviewing existing-index attachment and future-index template coverage as separate acceptance lists before enabling deletion.

\n
    \n
  1. Prepare an index population worksheet containing the approved pattern, actual existing names and explicitly excluded controls. Obtain the data owner’s retention decision independently of the documentation’s example interval. Review whether the intended condition is expressed in index age. Keep exceptions and any separate document-level requirement visible instead of assuming that an index-level example satisfies every retention obligation.
    2. \n
  2. Inspect the proposed template and the explicit existing-index attachment list together. Have another operator identify a future name that should match and one that must not. Review existing policy assignments before applying a new one. Do not treat creation of a policy definition as proof that either the old indices or tomorrow’s indices have the intended policy.
    3. \n
  3. Rehearse on disposable indices with a deliberately limited population and approved test timing. Preserve the reviewed policy definition and recovery references before scheduling any production deletion. Name the owner who will inspect the assignment and state observations. Stop if the selected population differs from the worksheet rather than widening a pattern simply to make more indices appear managed.
    4. \n
\n

Verification and evidence

\n

Proposed verification: inspect an existing disposable index after explicit attachment, then create a separate approved test index for the future-template case. Record the actual policy assignment in both cases and verify that the excluded control remains outside the intended population. Keep these observations separate from a later transition or deletion result.

\n

If a deletion rehearsal is authorized, retain the actual state, condition, operation and recovery observations for that disposable population. Do not invent a successful deletion or assume the policy acts at an exact wall-clock instant not established by the source. No index policy, live index or retention setting was changed for this article.

\n

Official references

\n\n

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.

\n", "content_text": "Bottom line: Define the indices covered by a retention policy before enabling its deletion action. Keep automatic assignment to future indices separate from applying the policy to the existing population.\nSource fact: documented behavior\nThe Index lifecycle management guide uses ISM policies to trigger index operations from conditions such as age, size and document count.\nThe retention procedure uses an ISM template and index pattern for automatic policy assignment to future alert indices.\nIt separately directs an operator to select existing indices and apply the policy to them, while the deletion example transitions on minimum index age.\nWhat the source does not establish\nThis article plans policy assignment and an index-age deletion condition. It does not set a legal retention period, equate index age with every contained document’s age or approve deletion of any index merely because its name matches an example.\nApplicability questions\n\nWhich exact current and future index names belong to the approved population?\nWhat minimum index age and deletion authority are agreed?\nWhich existing indices already have another policy?\nWhat recovery and observation plan is required before automation?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends reviewing existing-index attachment and future-index template coverage as separate acceptance lists before enabling deletion.\n\nPrepare an index population worksheet containing the approved pattern, actual existing names and explicitly excluded controls. Obtain the data owner’s retention decision independently of the documentation’s example interval. Review whether the intended condition is expressed in index age. Keep exceptions and any separate document-level requirement visible instead of assuming that an index-level example satisfies every retention obligation.\nInspect the proposed template and the explicit existing-index attachment list together. Have another operator identify a future name that should match and one that must not. Review existing policy assignments before applying a new one. Do not treat creation of a policy definition as proof that either the old indices or tomorrow’s indices have the intended policy.\nRehearse on disposable indices with a deliberately limited population and approved test timing. Preserve the reviewed policy definition and recovery references before scheduling any production deletion. Name the owner who will inspect the assignment and state observations. Stop if the selected population differs from the worksheet rather than widening a pattern simply to make more indices appear managed.\n\nVerification and evidence\nProposed verification: inspect an existing disposable index after explicit attachment, then create a separate approved test index for the future-template case. Record the actual policy assignment in both cases and verify that the excluded control remains outside the intended population. Keep these observations separate from a later transition or deletion result.\nIf a deletion rehearsal is authorized, retain the actual state, condition, operation and recovery observations for that disposable population. Do not invent a successful deletion or assume the policy acts at an exact wall-clock instant not established by the source. No index policy, live index or retention setting was changed for this article.\nOfficial references\n\nIndex lifecycle management — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "content_markdown": "Bottom line: Define the indices covered by a retention policy before enabling its deletion action. Keep automatic assignment to future indices separate from applying the policy to the existing population.\n\n## Source fact: documented behavior\n\nThe [Index lifecycle management](https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/index-lifecycle-management.html) guide uses ISM policies to trigger index operations from conditions such as age, size and document count.\n\nThe retention procedure uses an ISM template and index pattern for automatic policy assignment to future alert indices.\n\nIt separately directs an operator to select existing indices and apply the policy to them, while the deletion example transitions on minimum index age.\n\n## What the source does not establish\n\nThis article plans policy assignment and an index-age deletion condition. It does not set a legal retention period, equate index age with every contained document’s age or approve deletion of any index merely because its name matches an example.\n\n## Applicability questions\n\n- Which exact current and future index names belong to the approved population?\n\n- What minimum index age and deletion authority are agreed?\n\n- Which existing indices already have another policy?\n\n- What recovery and observation plan is required before automation?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends reviewing existing-index attachment and future-index template coverage as separate acceptance lists before enabling deletion.\n\n- Prepare an index population worksheet containing the approved pattern, actual existing names and explicitly excluded controls. Obtain the data owner’s retention decision independently of the documentation’s example interval. Review whether the intended condition is expressed in index age. Keep exceptions and any separate document-level requirement visible instead of assuming that an index-level example satisfies every retention obligation.\n\n- Inspect the proposed template and the explicit existing-index attachment list together. Have another operator identify a future name that should match and one that must not. Review existing policy assignments before applying a new one. Do not treat creation of a policy definition as proof that either the old indices or tomorrow’s indices have the intended policy.\n\n- Rehearse on disposable indices with a deliberately limited population and approved test timing. Preserve the reviewed policy definition and recovery references before scheduling any production deletion. Name the owner who will inspect the assignment and state observations. Stop if the selected population differs from the worksheet rather than widening a pattern simply to make more indices appear managed.\n\n## Verification and evidence\n\nProposed verification: inspect an existing disposable index after explicit attachment, then create a separate approved test index for the future-template case. Record the actual policy assignment in both cases and verify that the excluded control remains outside the intended population. Keep these observations separate from a later transition or deletion result.\n\nIf a deletion rehearsal is authorized, retain the actual state, condition, operation and recovery observations for that disposable population. Do not invent a successful deletion or assume the policy acts at an exact wall-clock instant not established by the source. No index policy, live index or retention setting was changed for this article.\n\n## Official references\n\n- [Index lifecycle management](https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/index-lifecycle-management.html) — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "url": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Business Continuity", "item": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "ListItem", "position": 3, "name": "Apply Wazuh index policies to existing and future indices deliberately", "item": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/#article", "identifier": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "url": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/", "headline": "Apply Wazuh index policies to existing and future indices deliberately", "description": "Review Wazuh ISM assignment to future index patterns separately from explicit attachment to existing indices.", "abstract": "Review Wazuh ISM assignment to future index patterns separately from explicit attachment to existing indices. Approve the intended deletion population and age condition before enabling automation.", "articleBody": "Bottom line: Define the indices covered by a retention policy before enabling its deletion action. Keep automatic assignment to future indices separate from applying the policy to the existing population.\nSource fact: documented behavior\nThe Index lifecycle management guide uses ISM policies to trigger index operations from conditions such as age, size and document count.\nThe retention procedure uses an ISM template and index pattern for automatic policy assignment to future alert indices.\nIt separately directs an operator to select existing indices and apply the policy to them, while the deletion example transitions on minimum index age.\nWhat the source does not establish\nThis article plans policy assignment and an index-age deletion condition. It does not set a legal retention period, equate index age with every contained document’s age or approve deletion of any index merely because its name matches an example.\nApplicability questions\n\nWhich exact current and future index names belong to the approved population?\nWhat minimum index age and deletion authority are agreed?\nWhich existing indices already have another policy?\nWhat recovery and observation plan is required before automation?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends reviewing existing-index attachment and future-index template coverage as separate acceptance lists before enabling deletion.\n\nPrepare an index population worksheet containing the approved pattern, actual existing names and explicitly excluded controls. Obtain the data owner’s retention decision independently of the documentation’s example interval. Review whether the intended condition is expressed in index age. Keep exceptions and any separate document-level requirement visible instead of assuming that an index-level example satisfies every retention obligation.\nInspect the proposed template and the explicit existing-index attachment list together. Have another operator identify a future name that should match and one that must not. Review existing policy assignments before applying a new one. Do not treat creation of a policy definition as proof that either the old indices or tomorrow’s indices have the intended policy.\nRehearse on disposable indices with a deliberately limited population and approved test timing. Preserve the reviewed policy definition and recovery references before scheduling any production deletion. Name the owner who will inspect the assignment and state observations. Stop if the selected population differs from the worksheet rather than widening a pattern simply to make more indices appear managed.\n\nVerification and evidence\nProposed verification: inspect an existing disposable index after explicit attachment, then create a separate approved test index for the future-template case. Record the actual policy assignment in both cases and verify that the excluded control remains outside the intended population. Keep these observations separate from a later transition or deletion result.\nIf a deletion rehearsal is authorized, retain the actual state, condition, operation and recovery observations for that disposable population. Do not invent a successful deletion or assume the policy acts at an exact wall-clock instant not established by the source. No index policy, live index or retention setting was changed for this article.\nOfficial references\n\nIndex lifecycle management — Wazuh; official product documentation.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "datePublished": "2026-10-30T06:47:14+00:00", "dateModified": "2026-10-30T06:47:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/apply-wazuh-index-policies-to-existing-and-future-indices-deliberately/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Apply Wazuh index policies to existing and future indices deliberately" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 516, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Wazuh — Index lifecycle management", "url": "https://documentation.wazuh.com/current/user-manual/wazuh-indexer-cluster/index-lifecycle-management.html" } } ] } }